- Kernel - mailweb.openeuler.org

[PATCH OLK-5.10 v2 0/2] block: support to dispatch bio asynchronously
by Li Nan 14 Jun '24

14 Jun '24

v2: bugfix and code optimization. Li Nan (2): block: support to dispatch bio asynchronously block: fix kabi broken in struct request_queue about CONFIG_BLK_BIO_DISPATCH_ASYNC block/blk.h | 7 + include/linux/blk_types.h | 1 + include/linux/blkdev.h | 9 + block/blk-core.c | 238 ++++++++++++++++++++++++- block/blk-mq-debugfs.c | 1 + block/blk-sysfs.c | 60 +++++++ arch/arm64/configs/openeuler_defconfig | 1 + arch/x86/configs/openeuler_defconfig | 1 + block/Kconfig | 11 ++ 9 files changed, 328 insertions(+), 1 deletion(-) -- 2.39.2

2 3

[PATCH openEuler-1.0-LTS] iio: mma8452: Fix trigger reference couting
by Zhang Changzhong 14 Jun '24

14 Jun '24

From: Lars-Peter Clausen <lars(a)metafoo.de> stable inclusion from stable-v4.19.221 commit f5deab10ced368c807866283f8b79144c4823be8 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9S271 CVE: CVE-2021-47500 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit cd0082235783f814241a1c9483fb89e405f4f892 upstream. The mma8452 driver directly assigns a trigger to the struct iio_dev. The IIO core when done using this trigger will call `iio_trigger_put()` to drop the reference count by 1. Without the matching `iio_trigger_get()` in the driver the reference count can reach 0 too early, the trigger gets freed while still in use and a use-after-free occurs. Fix this by getting a reference to the trigger before assigning it to the IIO device. Fixes: ae6d9ce05691 ("iio: mma8452: Add support for interrupt driven triggers.") Signed-off-by: Lars-Peter Clausen <lars(a)metafoo.de> Link: https://lore.kernel.org/r/20211024092700.6844-1-lars@metafoo.de Cc: <Stable(a)vger.kernel.org> Signed-off-by: Jonathan Cameron <Jonathan.Cameron(a)huawei.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- drivers/iio/accel/mma8452.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/iio/accel/mma8452.c b/drivers/iio/accel/mma8452.c index 421a0a8..db815ba 100644 --- a/drivers/iio/accel/mma8452.c +++ b/drivers/iio/accel/mma8452.c @@ -1465,7 +1465,7 @@ static int mma8452_trigger_setup(struct iio_dev *indio_dev) if (ret) return ret; - indio_dev->trig = trig; + indio_dev->trig = iio_trigger_get(trig); return 0; } -- 2.9.5

2 1

[PATCH OLK-5.10 v3 00/26] xfs: atomic writes for xfs
by Long Li 13 Jun '24

13 Jun '24

THis patch set support xfs atomic writes feature. Alan Adamson (1): nvme: Atomic write support Darrick J. Wong (3): fs: xfs: Introduce FORCEALIGN inode flag fs: xfs: Enable file data forcealign feature fs: xfs: Make file data allocations observe the 'forcealign' flag John Garry (11): block: Add core atomic write support fs: xfs: Do not free EOF blocks for forcealign fs: iomap: Sub-extent zeroing fs: xfs: iomap: Sub-extent zeroing fs: Add FS_XFLAG_ATOMICWRITES flag fs: iomap: Atomic write support fs: xfs: Support FS_XFLAG_ATOMICWRITES for forcealign fs: xfs: Validate atomic writes fs: xfs: Support setting FMODE_CAN_ATOMIC_WRITE xfs: Update xfs_is_falloc_aligned() mask for forcealign xfs: Only free full extents for forcealign Long Li (6): block: get atomic write max sectors xfs: support atomic write ioctl xfs: atomic write file dio convert to mark IOCB_ATOMIC xfs: fix set xflags fail when inode has extent hit xfs: make bunmapi observe forcealigin block: fix kabi in struct queue_limits Prasad Singamsetty (1): fs: Initial atomic write support Zhang Yi (4): math64: add rem_u64() to just return the remainder iomap: pass blocksize to iomap_truncate_page() xfs: refactor the truncating order xfs: correct the truncate blocksize of realtime inode Documentation/ABI/testing/sysfs-block | 52 ++++++++++++ block/blk-core.c | 39 ++++++++- block/blk-merge.c | 95 ++++++++++++++++++++- block/blk-settings.c | 55 ++++++++++++ block/blk-sysfs.c | 34 ++++++++ block/blk.h | 1 + drivers/md/dm-table.c | 1 + drivers/nvme/host/core.c | 56 ++++++++++++ fs/aio.c | 8 +- fs/iomap/buffered-io.c | 8 +- fs/iomap/direct-io.c | 33 +++++-- fs/read_write.c | 2 +- fs/xfs/libxfs/xfs_bmap.c | 22 ++++- fs/xfs/libxfs/xfs_format.h | 15 +++- fs/xfs/libxfs/xfs_inode_buf.c | 40 +++++++++ fs/xfs/libxfs/xfs_inode_buf.h | 3 + fs/xfs/libxfs/xfs_sb.c | 4 + fs/xfs/xfs_bmap_util.c | 10 ++- fs/xfs/xfs_file.c | 41 ++++++++- fs/xfs/xfs_inode.c | 43 ++++++++++ fs/xfs/xfs_inode.h | 12 +++ fs/xfs/xfs_ioctl.c | 96 ++++++++++++++++++++- fs/xfs/xfs_iomap.c | 19 ++++- fs/xfs/xfs_iops.c | 118 +++++++++++++------------- fs/xfs/xfs_mount.h | 5 ++ fs/xfs/xfs_super.c | 9 ++ include/linux/blk_types.h | 7 ++ include/linux/blkdev.h | 76 ++++++++++++++++- include/linux/fs.h | 30 ++++++- include/linux/iomap.h | 5 +- include/linux/math64.h | 24 ++++++ include/uapi/linux/fs.h | 9 +- io_uring/io_uring.c | 2 +- 33 files changed, 877 insertions(+), 97 deletions(-) -- 2.31.1

2 27

[PATCH openEuler-1.0-LTS] watchdog: Fix possible use-after-free by calling del_timer_sync()
by Jialin Zhang 13 Jun '24

13 Jun '24

From: Zou Wei <zou_wei(a)huawei.com> stable inclusion from stable-v4.19.198 commit ecd620e0fb1ff7f78fdb593379b2e6938c99707a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9RL1P CVE: CVE-2021-47321 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit d0212f095ab56672f6f36aabc605bda205e1e0bf ] This driver's remove path calls del_timer(). However, that function does not wait until the timer handler finishes. This means that the timer handler may still be running after the driver's remove function has finished, which would result in a use-after-free. Fix by calling del_timer_sync(), which makes sure the timer handler has finished, and unable to re-schedule itself. Reported-by: Hulk Robot <hulkci(a)huawei.com> Signed-off-by: Zou Wei <zou_wei(a)huawei.com> Reviewed-by: Guenter Roeck <linux(a)roeck-us.net> Acked-by: Vladimir Zapolskiy <vz(a)mleia.com> Link: https://lore.kernel.org/r/1620802676-19701-1-git-send-email-zou_wei@huawei.… Signed-off-by: Guenter Roeck <linux(a)roeck-us.net> Signed-off-by: Wim Van Sebroeck <wim(a)linux-watchdog.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Jialin Zhang <zhangjialin11(a)huawei.com> --- drivers/watchdog/lpc18xx_wdt.c | 2 +- drivers/watchdog/w83877f_wdt.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/watchdog/lpc18xx_wdt.c b/drivers/watchdog/lpc18xx_wdt.c index 331cadb459ac..48580b6406c2 100644 --- a/drivers/watchdog/lpc18xx_wdt.c +++ b/drivers/watchdog/lpc18xx_wdt.c @@ -301,7 +301,7 @@ static int lpc18xx_wdt_remove(struct platform_device *pdev) struct lpc18xx_wdt_dev *lpc18xx_wdt = platform_get_drvdata(pdev); dev_warn(&pdev->dev, "I quit now, hardware will probably reboot!\n"); - del_timer(&lpc18xx_wdt->timer); + del_timer_sync(&lpc18xx_wdt->timer); watchdog_unregister_device(&lpc18xx_wdt->wdt_dev); clk_disable_unprepare(lpc18xx_wdt->wdt_clk); diff --git a/drivers/watchdog/w83877f_wdt.c b/drivers/watchdog/w83877f_wdt.c index 05658ecc0aa4..ec4641fc2d21 100644 --- a/drivers/watchdog/w83877f_wdt.c +++ b/drivers/watchdog/w83877f_wdt.c @@ -170,7 +170,7 @@ static void wdt_startup(void) static void wdt_turnoff(void) { /* Stop the timer */ - del_timer(&timer); + del_timer_sync(&timer); wdt_change(WDT_DISABLE); -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS 0/1] CVE-2021-47261
by Yongqiang Liu 13 Jun '24

13 Jun '24

Alaa Hleihel (1): IB/mlx5: Fix initializing CQ fragments buffer drivers/infiniband/hw/mlx5/cq.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) -- 2.34.1

2 2

[PATCH openEuler-22.03-LTS-SP1 0/1] CVE-2024-36020
by Yongqiang Liu 13 Jun '24

13 Jun '24

Aleksandr Loktionov (1): i40e: fix vf may be used uninitialized in this function warning .../ethernet/intel/i40e/i40e_virtchnl_pf.c | 34 +++++++++---------- 1 file changed, 16 insertions(+), 18 deletions(-) -- 2.34.1

2 2

[PATCH openEuler-22.03-LTS-SP1] drm/panel: fix a possible null pointer dereference
by Jialin Zhang 13 Jun '24

13 Jun '24

From: Ma Ke <make_ruc2021(a)163.com> stable inclusion from stable-v5.10.202 commit c7dc0aca5962fb37dbea9769dd26ec37813faae1 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9RFEM CVE: CVE-2023-52821 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 924e5814d1f84e6fa5cb19c6eceb69f066225229 ] In versatile_panel_get_modes(), the return value of drm_mode_duplicate() is assigned to mode, which will lead to a NULL pointer dereference on failure of drm_mode_duplicate(). Add a check to avoid npd. Signed-off-by: Ma Ke <make_ruc2021(a)163.com> Reviewed-by: Neil Armstrong <neil.armstrong(a)linaro.org> Link: https://lore.kernel.org/r/20231007033105.3997998-1-make_ruc2021@163.com Signed-off-by: Neil Armstrong <neil.armstrong(a)linaro.org> Link: https://patchwork.freedesktop.org/patch/msgid/20231007033105.3997998-1-make… Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Jialin Zhang <zhangjialin11(a)huawei.com> --- drivers/gpu/drm/panel/panel-arm-versatile.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/gpu/drm/panel/panel-arm-versatile.c b/drivers/gpu/drm/panel/panel-arm-versatile.c index abb0788843c6..503ecea72c5e 100644 --- a/drivers/gpu/drm/panel/panel-arm-versatile.c +++ b/drivers/gpu/drm/panel/panel-arm-versatile.c @@ -267,6 +267,8 @@ static int versatile_panel_get_modes(struct drm_panel *panel, connector->display_info.bus_flags = vpanel->panel_type->bus_flags; mode = drm_mode_duplicate(connector->dev, &vpanel->panel_type->mode); + if (!mode) + return -ENOMEM; drm_mode_set_name(mode); mode->type = DRM_MODE_TYPE_DRIVER | DRM_MODE_TYPE_PREFERRED; -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1 0/1] CVE-2024-36020
by Yongqiang Liu 13 Jun '24

13 Jun '24

Aleksandr Loktionov (1): i40e: fix vf may be used uninitialized in this function warning .../ethernet/intel/i40e/i40e_virtchnl_pf.c | 34 +++++++++---------- 1 file changed, 16 insertions(+), 18 deletions(-) -- 2.34.1

2 2

[PATCH OLK-5.10 0/1] CVE-2024-36020
by Yongqiang Liu 13 Jun '24

13 Jun '24

Aleksandr Loktionov (1): i40e: fix vf may be used uninitialized in this function warning .../ethernet/intel/i40e/i40e_virtchnl_pf.c | 34 +++++++++---------- 1 file changed, 16 insertions(+), 18 deletions(-) -- 2.34.1

2 2

[PATCH openEuler-22.03-LTS-SP1] soc: fsl: qbman: Use raw spinlock for cgr_lock
by Jialin Zhang 13 Jun '24

13 Jun '24

From: Sean Anderson <sean.anderson(a)linux.dev> stable inclusion from stable-v5.10.215 commit 32edca2f03a6cc42c650ddc3ad83d086e3f365d1 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q9CD CVE: CVE-2024-35819 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit fbec4e7fed89b579f2483041fabf9650fb0dd6bc ] smp_call_function always runs its callback in hard IRQ context, even on PREEMPT_RT, where spinlocks can sleep. So we need to use a raw spinlock for cgr_lock to ensure we aren't waiting on a sleeping task. Although this bug has existed for a while, it was not apparent until commit ef2a8d5478b9 ("net: dpaa: Adjust queue depth on rate change") which invokes smp_call_function_single via qman_update_cgr_safe every time a link goes up or down. Fixes: 96f413f47677 ("soc/fsl/qbman: fix issue in qman_delete_cgr_safe()") CC: stable(a)vger.kernel.org Reported-by: Vladimir Oltean <vladimir.oltean(a)nxp.com> Closes: https://lore.kernel.org/all/20230323153935.nofnjucqjqnz34ej@skbuf/ Reported-by: Steffen Trumtrar <s.trumtrar(a)pengutronix.de> Closes: https://lore.kernel.org/linux-arm-kernel/87wmsyvclu.fsf@pengutronix.de/ Signed-off-by: Sean Anderson <sean.anderson(a)linux.dev> Reviewed-by: Camelia Groza <camelia.groza(a)nxp.com> Tested-by: Vladimir Oltean <vladimir.oltean(a)nxp.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/soc/fsl/qbman/qman.c [The conflict occurs because commit c542f3a70521("soc: fsl: qbman: Add helper for sanity checking cgr ops") and commit 39ed969a7a54("soc: fsl: qbman: Add CGR update function") is not merged. The function qman_update_cgr() does not exist on this branch.] Signed-off-by: Jialin Zhang <zhangjialin11(a)huawei.com> --- drivers/soc/fsl/qbman/qman.c | 21 ++++++++++++--------- 1 file changed, 12 insertions(+), 9 deletions(-) diff --git a/drivers/soc/fsl/qbman/qman.c b/drivers/soc/fsl/qbman/qman.c index d8267e6c31a5..f6e270565dde 100644 --- a/drivers/soc/fsl/qbman/qman.c +++ b/drivers/soc/fsl/qbman/qman.c @@ -991,7 +991,7 @@ struct qman_portal { /* linked-list of CSCN handlers. */ struct list_head cgr_cbs; /* list lock */ - spinlock_t cgr_lock; + raw_spinlock_t cgr_lock; struct work_struct congestion_work; struct work_struct mr_work; char irqname[MAX_IRQNAME]; @@ -1281,7 +1281,7 @@ static int qman_create_portal(struct qman_portal *portal, /* if the given mask is NULL, assume all CGRs can be seen */ qman_cgrs_fill(&portal->cgrs[0]); INIT_LIST_HEAD(&portal->cgr_cbs); - spin_lock_init(&portal->cgr_lock); + raw_spin_lock_init(&portal->cgr_lock); INIT_WORK(&portal->congestion_work, qm_congestion_task); INIT_WORK(&portal->mr_work, qm_mr_process_task); portal->bits = 0; @@ -1456,11 +1456,14 @@ static void qm_congestion_task(struct work_struct *work) union qm_mc_result *mcr; struct qman_cgr *cgr; - spin_lock_irq(&p->cgr_lock); + /* + * FIXME: QM_MCR_TIMEOUT is 10ms, which is too long for a raw spinlock! + */ + raw_spin_lock_irq(&p->cgr_lock); qm_mc_start(&p->p); qm_mc_commit(&p->p, QM_MCC_VERB_QUERYCONGESTION); if (!qm_mc_result_timeout(&p->p, &mcr)) { - spin_unlock_irq(&p->cgr_lock); + raw_spin_unlock_irq(&p->cgr_lock); dev_crit(p->config->dev, "QUERYCONGESTION timeout\n"); qman_p_irqsource_add(p, QM_PIRQ_CSCI); return; @@ -1476,7 +1479,7 @@ static void qm_congestion_task(struct work_struct *work) list_for_each_entry(cgr, &p->cgr_cbs, node) if (cgr->cb && qman_cgrs_get(&c, cgr->cgrid)) cgr->cb(p, cgr, qman_cgrs_get(&rr, cgr->cgrid)); - spin_unlock_irq(&p->cgr_lock); + raw_spin_unlock_irq(&p->cgr_lock); qman_p_irqsource_add(p, QM_PIRQ_CSCI); } @@ -2440,7 +2443,7 @@ int qman_create_cgr(struct qman_cgr *cgr, u32 flags, preempt_enable(); cgr->chan = p->config->channel; - spin_lock_irq(&p->cgr_lock); + raw_spin_lock_irq(&p->cgr_lock); if (opts) { struct qm_mcc_initcgr local_opts = *opts; @@ -2477,7 +2480,7 @@ int qman_create_cgr(struct qman_cgr *cgr, u32 flags, qman_cgrs_get(&p->cgrs[1], cgr->cgrid)) cgr->cb(p, cgr, 1); out: - spin_unlock_irq(&p->cgr_lock); + raw_spin_unlock_irq(&p->cgr_lock); put_affine_portal(); return ret; } @@ -2502,7 +2505,7 @@ int qman_delete_cgr(struct qman_cgr *cgr) goto put_portal; } memset(&local_opts, 0, sizeof(struct qm_mcc_initcgr)); - spin_lock_irqsave(&p->cgr_lock, irqflags); + raw_spin_lock_irqsave(&p->cgr_lock, irqflags); list_del(&cgr->node); /* * If there are no other CGR objects for this CGRID in the list, @@ -2527,7 +2530,7 @@ int qman_delete_cgr(struct qman_cgr *cgr) /* add back to the list */ list_add(&cgr->node, &p->cgr_cbs); release_lock: - spin_unlock_irqrestore(&p->cgr_lock, irqflags); + raw_spin_unlock_irqrestore(&p->cgr_lock, irqflags); put_portal: put_affine_portal(); return ret; -- 2.25.1

2 1